API docs by Redocly

IP-API.io - IP Geolocation & Security API (1.0.0)

Download OpenAPI specification:Download

IP-API.io Support: support@ip-api.io URL: https://ip-api.io License: Commercial License

Comprehensive IP address intelligence API providing geolocation, security analysis, and network information.

Features:

  • Real-time IP geolocation with city-level accuracy
  • Advanced threat detection and security scoring
  • VPN, proxy, and Tor node detection
  • Email validation and reputation analysis
  • Email / ip risk scoring for fraud prevention

Perfect for fraud prevention, security applications, content personalization, and compliance requirements.

Advanced Email Validation API

Advanced email validation service with comprehensive deliverability analysis and SMTP verification.

Advanced Validation Features:

  • Real-time SMTP server verification
  • Inbox reachability testing
  • Catch-all domain detection
  • Advanced disposable email detection
  • Gravatar profile verification
  • Role-based account identification
  • Free email provider detection
  • Domain suggestion for typos
  • MX record validation

Use Cases:

  • Marketing campaign optimization
  • User registration with high confidence
  • E-commerce customer validation
  • Lead qualification
  • Fraud prevention workflows
  • Email list cleaning and verification

Performance: Response time varies 500ms-2s due to real-time SMTP checks Accuracy: 95%+ accuracy for deliverability assessment

Advanced email validation with SMTP verification

Performs comprehensive email validation including real-time SMTP verification, deliverability assessment, and advanced fraud detection.

Validation Process:

  1. Syntax Validation: RFC 5322/5321 compliance checking
  2. DNS Verification: MX record validation and domain reputation
  3. SMTP Testing: Real-time connection to mail server
  4. Deliverability Check: Inbox reachability assessment
  5. Security Analysis: Disposable email and role account detection
  6. Enhancement: Gravatar detection and domain suggestions

Advanced Features:

  • SMTP Verification: Real-time mail server connectivity testing
  • Inbox Analysis: Full inbox and catch-all domain detection
  • Provider Intelligence: Free vs. paid email provider identification
  • Security Screening: Role accounts and disposable email detection
  • User Experience: Domain typo suggestions and corrections

Response Includes:

  • Comprehensive reachability assessment (yes/no/unknown)
  • Detailed SMTP server analysis
  • Gravatar profile availability
  • Domain suggestion for typos
  • Advanced fraud prevention flags

Performance Note: This endpoint performs real-time SMTP checks which may take 500ms-2s

path Parameters
email
required
string
Example: test@yandex.ru

Email address to validate with advanced analysis. Must be properly URL-encoded if containing special characters.

Supported Formats:

Size Limits: Maximum 320 characters (64 for local part + 255 for domain) Encoding: URL encoding required for special characters

Examples:

Performance: Advanced validation includes real-time SMTP checks which may take 500ms-2s

Responses

Response samples

Content type
application/json
{
  • "email": "test@yandex.ru",
  • "reachable": "no",
  • "syntax": {
    },
  • "smtp": {
    },
  • "gravatar": {
    },
  • "suggestion": "",
  • "disposable": false,
  • "role_account": true,
  • "free": true,
  • "has_mx_records": true
}

Email Validation API

Comprehensive email validation and analysis service for fraud prevention and data quality.

Validation Features:

  • RFC 5322/5321 syntax compliance checking
  • Real-time MX record verification
  • Disposable email provider detection (10,000+ domains)
  • Typosquatting and misspelling detection
  • Free email provider identification
  • Role-based email detection (admin@, noreply@, etc.)

Use Cases:

  • User registration validation
  • Marketing list cleaning
  • Fraud prevention workflows
  • Data quality assurance
  • Compliance verification

Performance: Typical response time < 150ms with 99.9% uptime SLA

Comprehensive email validation and analysis

Performs detailed validation and analysis of an email address for fraud prevention and data quality.

Validation Process:

  1. Syntax Validation: RFC 5322 compliance checking
  2. Domain Analysis: MX record verification and domain reputation
  3. Provider Detection: Identifies disposable, free, and role-based emails
  4. Security Checks: Typosquatting and suspicious pattern detection
  5. Deliverability Assessment: Real-time SMTP verification (optional)

Response Includes:

  • Detailed validation results with specific error reasons
  • Domain and username breakdown
  • Disposable email service detection
  • Syntax compliance status

Performance: Cached results for improved response times on repeated queries

path Parameters
email
required
string
Example: john.doe@company.com

Email address to validate and analyze. Must be properly URL-encoded if containing special characters.

Supported Formats:

Size Limits: Maximum 320 characters (64 for local part + 255 for domain) Encoding: URL encoding required for special characters

Examples:

  • Simple: john.doe@company.com
  • Complex: "test user"@sub.domain.co.uk
  • International: user@exämple.com

Responses

Response samples

Content type
application/json
{
  • "email": "john.doe@company.com",
  • "is_disposable": false,
  • "syntax": {
    }
}

Risk Score API

Advanced fraud detection API that calculates risk scores for IP addresses and email addresses.

Risk Score Range: 0.0-1.0 (higher = more risky)

  • 0.8-1.0: Very High Risk (immediate review recommended)
  • 0.6-0.8: High Risk (enhanced verification required)
  • 0.4-0.6: Medium Risk (standard verification)
  • 0.2-0.4: Low Risk (minimal verification)
  • 0.0-0.2: Very Low Risk (trusted)

Analysis Factors:

  • IP: VPN/Proxy detection, Tor nodes, datacenter hosting, spam history, threat intelligence
  • Email: Disposable providers, syntax validation, domain reputation, MX record verification

Rate Limiting: API calls are rate-limited per client IP or API key to ensure fair usage.

Calculate risk score from client IP

Automatically detects and analyzes the client's IP address from the HTTP request.

IP Detection Order:

  1. X-Real-IP header (preferred for load balancers/proxies)
  2. RemoteAddr from servlet request

Use Cases:

  • Real-time fraud detection during user sessions
  • Account creation risk assessment
  • Transaction monitoring without explicit IP parameter

Returns: Complete risk score analysis with risk factors breakdown

Responses

Response samples

Content type
application/json
{
  • "score": 0.675,
  • "risk_level": "HIGH",
  • "ip": "203.0.113.195",
  • "email": "user@example.com",
  • "factors": {
    }
}

Calculate risk score for specific IP address

Analyzes a specific IP address with optional email correlation for enhanced fraud detection.

IP Analysis Includes:

  • Network type classification (residential, datacenter, mobile)
  • Anonymization service detection (VPN, proxy, Tor)
  • Threat intelligence feeds (spam, malware, botnet)
  • Geographic anomaly detection
  • Historical behavior patterns

Combined Analysis (when email provided):

  • Cross-reference IP and email reputation
  • Account takeover risk assessment
  • Multi-factor fraud indicators

Response Time: Typically < 200ms for cached results, < 1s for new lookups

path Parameters
ip
required
string
Example: 203.0.113.195

Target IP address for risk score analysis. Supports both IPv4 (e.g., 203.0.113.1) and IPv6 (e.g., 2001:db8::1) formats. Private IP ranges (10.x.x.x, 192.168.x.x, 172.16-31.x.x) will return limited analysis.

query Parameters
email
string
Example: email=suspicious.user@tempmail.com

Optional email address for combined IP+email risk analysis. When provided, enables cross-correlation between IP and email reputation, account takeover detection, and enhanced fraud scoring. Must be a valid email format.

Responses

Response samples

Content type
application/json
{
  • "score": 0.675,
  • "risk_level": "HIGH",
  • "ip": "203.0.113.195",
  • "email": "user@example.com",
  • "factors": {
    }
}

Calculate risk score for email address

Performs comprehensive email-based fraud analysis without IP correlation.

Email Analysis Includes:

  • Syntax validation (RFC 5322 compliance)
  • Domain verification (MX record validation)
  • Disposable email service detection (10k+ providers)
  • Free email provider identification
  • Domain reputation scoring
  • Typosquatting detection
  • Recently created domain analysis

Use Cases:

  • Account registration validation
  • Email-based fraud prevention
  • Marketing list cleaning
  • Customer verification workflows

Data Sources: Real-time lookups against multiple threat intelligence feeds

path Parameters
email
required
string
Example: john.doe@legitbusiness.com

Email address for comprehensive trust analysis. Must be a valid email format (user@domain.tld). The system will validate syntax, check domain reputation, detect disposable email services, and assess overall risk. International domains and IDN (Internationalized Domain Names) are supported.

Responses

Response samples

Content type
application/json
{
  • "score": 0.675,
  • "risk_level": "HIGH",
  • "ip": "203.0.113.195",
  • "email": "user@example.com",
  • "factors": {
    }
}

IP Geolocation & Security API

Advanced IP address intelligence service providing geolocation, security analysis, and threat detection.

Core Features:

  • High-precision geolocation (city-level accuracy)
  • Real-time timezone and local time calculation
  • Comprehensive threat intelligence (VPN, proxy, Tor detection)
  • ISP and network classification
  • Abuse and reputation scoring

Security Analysis:

  • Proxy & VPN detection with 99.5% accuracy
  • Tor node identification (real-time consensus)
  • Spam and malware source detection
  • Datacenter and hosting provider classification
  • Threat intelligence from 50+ global feeds

Geolocation Accuracy:

  • Country: 99.8% accuracy
  • City: 85-95% accuracy (varies by region)
  • Coordinates: ~50km median accuracy

Use Cases: Fraud prevention, content localization, compliance, analytics, security monitoring

Get IP intelligence from client request

Automatically analyzes the client's IP address from HTTP request headers for comprehensive intelligence gathering.

IP Detection Strategy:

  1. X-Real-IP Header: Preferred for load balancers and reverse proxies
  2. X-Forwarded-For: First non-private IP in the chain
  3. RemoteAddr: Direct connection IP (fallback)

Analysis Includes:

  • Precise geolocation with city-level accuracy
  • Real-time timezone calculation with DST detection
  • Comprehensive security threat assessment
  • Network classification (residential, datacenter, mobile)
  • ISP and organization identification

Use Cases:

  • User session fraud detection
  • Content personalization by location
  • Timezone-aware application behavior
  • Real-time security monitoring

Privacy: No personal information is logged or stored

Responses

Response samples

Content type
application/json
{
  • "ip": "203.0.113.195",
  • "suspicious_factors": {
    },
  • "location": {
    }
}

Get comprehensive IP intelligence for specific address

Performs detailed analysis of a specific IP address providing geolocation, security assessment, and network intelligence.

Geolocation Analysis:

  • Country, region, and city identification
  • Latitude/longitude coordinates with accuracy indicators
  • Postal/ZIP code when available
  • ISP and organization details
  • Connection type classification

Security Intelligence:

  • Real-time threat assessment from 50+ feeds
  • VPN and proxy detection with confidence scoring
  • Tor network node identification
  • Spam source and malware C&C detection
  • Datacenter and hosting classification

Timezone Intelligence:

  • IANA timezone identification
  • Current local time calculation
  • Daylight saving time detection
  • UTC offset determination

Performance: Sub-second response with global CDN caching Accuracy: 99.8% country, 90%+ city-level precision

path Parameters
ip
required
string
Example: 203.0.113.195

IP address for comprehensive intelligence analysis.

Supported Formats:

  • IPv4: Standard dotted decimal (e.g., 203.0.113.195)
  • IPv6: Full or compressed format (e.g., 2001:db8::1)

Limitations:

  • Private ranges (RFC 1918) return limited geolocation data
  • Reserved ranges (RFC 5735/4291) may return partial information
  • Localhost (127.x.x.x, ::1) returns minimal data

Performance Notes:

  • Cached results: < 50ms response time
  • Fresh lookups: < 500ms response time
  • Global POPs for reduced latency

Examples:

  • Public IPv4: 8.8.8.8, 1.1.1.1
  • Public IPv6: 2001:4860:4860::8888
  • Corporate: 203.0.113.195

Responses

Response samples

Content type
application/json
{
  • "ip": "203.0.113.195",
  • "suspicious_factors": {
    },
  • "location": {
    }
}